Topic: Simple Machines Forums attacks

[b4pjoe]

Disabling Tor Access and setting up a Honeypot and installing httpBL worked for very well for me, and I've also been able to keep other bots like spammers at bay with this setup very well.

I'd love to be able to use httpBL but don't run my own server.  I've installed Arantor's patch and it's cut down the number of login attempts significantly but my main forums are still getting hit with registration attempts by bots that are blacklisted in the Project Honey Pot database. I closed registration several days ago so they can't get in, just fill up my error log.

Thanks to all who have been and are still working on these issues! I appreciate everyone's efforts!

Check out QuickLinks at the HoneyPot site. It's for people that don't have server access.

[robbie93]

I woke up to nine pages of errors today guys, it seems one set of errors have been replaced by another I'm now getting nine pages of these.

Guest
195.191.54.64   
Type of error: User 
http://robbie93andhotchildxox.net/index.php?action=login2
The letters you typed don't match the letters that were shown in the picture

[busterone]

I'd love to be able to use httpBL but don't run my own server.  I've installed Arantor's patch and it's cut down the number of login attempts significantly but my main forums are still getting hit with registration attempts by bots that are blacklisted in the Project Honey Pot database. I closed registration several days ago so they can't get in, just fill up my error log.

Thanks to all who have been and are still working on these issues! I appreciate everyone's efforts!

You don't need to have server level access to use the httpBL mod or install a honeypot. As long as you have ftp access and Cpanel(or whatever control panel your host uses), the mod works. See the documentation at http://www.projecthoneypot.org In short, install the honeypot within your webspace directory structure somewhere, get an API key, install httpBL, and enter the honeypot's url and your API key in the admin section of the mod. Hide your links in your forum and any other site you may have running and you are done. 

[aoife]

I'd love to be able to use httpBL but don't run my own server.  I've installed Arantor's patch and it's cut down the number of login attempts significantly but my main forums are still getting hit with registration attempts by bots that are blacklisted in the Project Honey Pot database. I closed registration several days ago so they can't get in, just fill up my error log.

Thanks to all who have been and are still working on these issues! I appreciate everyone's efforts!

You don't need to have server level access to use the httpBL mod or install a honeypot. As long as you have ftp access and Cpanel(or whatever control panel your host uses), the mod works. See the documentation at http://www.projecthoneypot.org In short, install the honeypot within your webspace directory structure somewhere, get an API key, install httpBL, and enter the honeypot's url and your API key in the admin section of the mod. Hide your links in your forum and any other site you may have running and you are done.

oh ok, kewl! I'll do that!  I do have a QuickLink installed too, btw - on all my sites and forums.  Thank you for the info!

[busterone]

Quite welcome. 

[N. N.]

I woke up to nine pages of errors today guys, it seems one set of errors have been replaced by another I'm now getting nine pages of these.

Guest
195.191.54.64   
Type of error: User 
http://robbie93andhotchildxox.net/index.php?action=login2
The letters you typed don't match the letters that were shown in the picture

None of these mods can STOP the bots from trying. Bots are trying. It's a fact of the internet.
Some of the mods log the attempts in SMF's error log (which IMHO it's useful for the admin to know that the attempts are happening on their forum), some don't, but they enhance protection nonetheless.
If you installed a mod that doesn't log anything, I would recommend to take a look in your webserver access log, to see if there are many requests to login2 or register2. You might find there are, meaning bots are still trying.

So what you see means probably that bots are trying, but they're stopped by Captcha on the login page. I strongly recommend activating a custom question too. Even a simple question like "3 + 2 = ?" would be useful.

[codenaught]

I assume that this is going to be addressed in the final release of 2.0.

Good luck continuing to handle all this nonsense. It's a shame how bad people force us to spend time on malicious prevention instead of on innovation at times.

[robbie93]

None of these mods can STOP the bots from trying. Bots are trying. It's a fact of the internet.
Some of the mods log the attempts in SMF's error log (which IMHO it's useful for the admin to know that the attempts are happening on their forum), some don't, but they enhance protection nonetheless.
If you installed a mod that doesn't log anything, I would recommend to take a look in your webserver access log, to see if there are many requests to login2 or register2. You might find there are, meaning bots are still trying.

So what you see means probably that bots are trying, but they're stopped by Captcha on the login page. I strongly recommend activating a custom question too. Even a simple question like "3 + 2 = ?" would be useful.

Ok, I added the question to the login page also, I'm not very good at mathematics so I used your example. 

[Arantor]

I assume that this is going to be addressed in the final release of 2.0.

This specific bot with this specific hack, I doubt it. It's not elegant enough nor broad enough to catch the entire set of bad behaviours. It just targets the MO of this specific bot.

I should note that there is discussion underway about nailing down the entire subsystem that the bot uses to try getting in, which would make it a general strengthening rather than something specific.

[N. N.]

I assume that this is going to be addressed in the final release of 2.0.

Good luck continuing to handle all this nonsense. It's a shame how bad people force us to spend time on malicious prevention instead of on innovation at times.

There will be improvements allowing to strengthen security. Thank you.

[butchs]

As far as bots go, I have been battling them over a year with Bad Behavior (recently re-written) and Forum Firewall and quite frankly they are no longer a issue for me.  The American way:  Block first, ask questions later works great.  Every now and then I will see a straggler.   That is it!

I believe SMF should concentrate on the things that cause the errors in the error logs.  Because bugs are a favorite target of bots.

[Arantor]

The matter I refer to is something I consider a bug

[Masterd]

Thanks for the tips, Norv!

[SomaliDoc]

Login detector worked for me as well but still there is a problem that members can't login to the forums in the first try, they have to enter the password again to log in.

When they first log in, the login2 page show up with the message "Password Incorrect". but when they put the same correct password again they are in.

Is this problem related to the bot issue & How I can solve it?

Thanks

[aoife]

Login detector worked for me as well but still there is a problem that members can't login to the forums in the first try, they have to enter the password again to log in.

When they first log in, the login2 page show up with the message "Password Incorrect". but when they put the same correct password again they are in.

Is this problem related to the bot issue & How I can solve it?

Thanks

I've had issues with this as well, without having any of the mods listed in this thread installed. It seems to happen after the members have requested a password reminder and change their passwords.

[b4pjoe]

I have the login detector and httpBL installed and have not seen this issue on RC5.

[SomaliDoc]

Login detector worked for me as well but still there is a problem that members can't login to the forums in the first try, they have to enter the password again to log in.

When they first log in, the login2 page show up with the message "Password Incorrect". but when they put the same correct password again they are in.

Is this problem related to the bot issue & How I can solve it?

Thanks

I've had issues with this as well, without having any of the mods listed in this thread installed. It seems to happen after the members have requested a password reminder and change their passwords.

This is happening all the time even without requesting password reminder?
Anyone knows what it's going in my forum?

[ethankcvds]

Is there a maximum password length (some of my users want to go to the max)?

I don't believe there is. If there IS, it'll be something like 50 characters.

You'll laugh but it is true (On SMF 2.0 at least) that you can use a 99 + character password.

[RustyBarnacle]

I got a lot of these and various guest parameter errors yesterday:

http://www.localwateringhole.ca/index.php?action=search2;params=eJwtzMEKgCAQBNB_6dLFg9KlvxFdFyxMY7Ui2I9vDW8zb2BcuF0GDDyz5ok99WTUooxWq0CN5bFQjjNhQ5k6XX5HaLbk9A4p1CQRJvzfBtmwkXDACl3QEUTpH7bdLBc.
8: Undefined index: title

Is this a sign of things to come?

[Joshua Dickerson]

Looks like your theme or a mod is broken.